Chasing the OPNsense RCE: The Story Behind My First CVEs

A security researcher discovered five vulnerabilities in OPNsense, a popular open-source firewall platform, during a designated research week, including a critical Remote Code Execution flaw (CVE-2026-57155) with a 9.9 CVSS rating achieved through arbitrary file write in the GeoIP Alias Importer. The researcher used manual taint analysis, ripgrep searches for dangerous functions, and dynamic fuzzing to identify the flaws across OPNsense's Phalcon-based web interface, with all five vulnerabilities now patched following responsible disclosure. This represented the researcher's first CVEs and demonstrates the importance of security audits in widely-used open-source software used in enterprise and home networks.